CVE-2026-8769: vercel ai provider-utils response-handler.ts createJsonErrorResponseHandler resource consumption
A vulnerability was determined in vercel ai up to 3.0.97. The impacted element is the function createJsonResponseHandler/createJsonErrorResponseHandler of the file packages/provider-utils/src/response-handler.ts of the component provider-utils. This manipulation causes resource consumption. The attack may be initiated remotely. The exploit has been publicly disclosed and may be utilized. The vendor was contacted early about this disclosure but did not respond in any way.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Remove
Remove
vercel ai/provider-utilsfrom your environment.Uninstall or remove the provider-utils component from deployments if it is not required to eliminate the vulnerable code paths in response-handler.ts.
- Configuration
Disable or avoid invoking createJsonResponseHandler and createJsonErrorResponseHandler in application code until a fix is available; replace with alternative safe handlers or add strict input validation and size checks around JSON processing.
vercel ai provider-utils (packages/provider-utils/src/response-handler.ts) use of createJsonResponseHandler/createJsonErrorResponseHandler = disabled / avoid calling - Compensating control
Implement network and application-level mitigations for endpoints that use vercel ai provider-utils: restrict access to trusted IPs, deploy WAF rules, and enforce rate limiting and request-size limits to reduce the impact of resource-consumption attempts against the response-handler functions.
- Operational
Monitor logs and resource metrics for signs of exploitation (e.g., spikes in CPU/memory or repeated requests to response-handler endpoints), block or rate-limit offending clients, and perform incident response if exploitation is detected.
Event History
Frequently Asked Questions
What is the severity of CVE-2026-8769?
CVE-2026-8769 is classified as a resource consumption vulnerability.
How do I fix CVE-2026-8769?
To mitigate CVE-2026-8769, upgrade the affected package to a version higher than 3.0.97.
What versions are affected by CVE-2026-8769?
CVE-2026-8769 affects vercel ai versions up to and including 3.0.97.
What component of the software is impacted by CVE-2026-8769?
CVE-2026-8769 impacts the createJsonResponseHandler and createJsonErrorResponseHandler functions in the response-handler.ts file.
How can CVE-2026-8769 impact my application?
CVE-2026-8769 can potentially lead to resource exhaustion and degradation of service in applications utilizing the affected versions.